Initial commit
Merge branch 'master' of github.com:m101/m101-tools
Add: Old custom SSH Bruteforce script
Initial commit
Add: Old custom SSH Bruteforce script
Mod : Restored read as the default action + add error message for it
Mod : Moved some code in class LFI
Merge branch 'master' of github.com:m101/m101-tools

Conflicts:
	exploit-lfi.py
Mod : Randomize strings
Mod: php://filter attack moved in class LFI
Add: Basic cookies support
Removed some randomized TODOs
LFI Scanner : Fixed apache log code injection technique + LFI dectection improvement

Fixed apache log code injection technique:
- It did not work as it wasn't properly injecting PHP code in it
- There is still a flaw to fix : it doesn't take into account the max
  length of a log line

LFI detection improvement:
- Added /etc/passwd test
- Added NULL byte injection test
- Need more improvement on error message detection

This code has been tested to work with phpLDAPadmin 1.1.0.5, DVWA and
multillidae.
LFI Scanner : No more limits for apache log command line length
LFI Scanner : Improved apache log technique output + paths optimisation

The output has been improved by incorporating the start and end tags in
the eval() parameter.

The paths optimisation:
- removed some duplicate paths
- re-ordered the apache logs path in order of probable existence
- testing error logs first then access logs, we could remove access logs
  test and assume that they are in the same directory as the error log
  if we want an optimisation heuristic.
LFI Scanner : Fix headers bug + find_root() and improved a bit detection and leak

headers bug:
- headers would all be removed and thus the default headers set wouldn't
  be taken into account

find_root() buf fix:
- It wouldn't find the root_path if there is an extension or something
  else appended to our page_name. self.url_suffix is thus appended to
  fix this
- Store dir_traversals to attain the root path

detection improvement:
- if a PHP script were to include links to our URL in the body of the
  page : false positive. In order to avoid this false positive, we check
  for function.include which shows when error messages are activated

leak improvement:
- add test for direct injection if php://filter fail
LFI Scanner : Re-ordered the detection tests so exploiting doesn't fail

Basically, if there is an extension appended, the inclusion bug may be
found but it wouldn't be exploitable as the NULL byte poisoning test was
done afterward for instance.
LFI Scanner : Applied a bit more object oriented paradigm
LFI Scanner : Small cosmetics changes
LFI Scanner : Factorized query building code in LFI.find_vuln_param()